Is Video Downloader Pro safe?
Video Downloader Pro is high risk. On Facebook, Video Downloader Pro reads the `fb_dtsg_ag` anti-CSRF token from outbound requests, saves it locally, then reuses it to call Facebook's video data endpoint with your user ID. Testing found the token in storage after a visit.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Facebook CSRF Token Captured and Stored by Video Downloader Pro
On Facebook, Video Downloader Pro reads the `fb_dtsg_ag` anti-CSRF token from outbound requests, saves it locally, then reuses it to call Facebook's video data endpoint with your user ID.
Testing found the token in storage after a visit.
- Severity
- High unwanted
- Type
- Unexpected
- CWE
- CWE-522
- Source
- Dynamic sandbox
You visit Facebook and your browser makes any request to facebook.com/ajax/* or facebook.com/video/video_data_async/.
This includes normal background activity triggered by loading the Facebook page; you do not need to click anything.
The extension reads the `fb_dtsg_ag` anti-CSRF token from the outbound request URL and saves it to its own local storage.
The token is later used by the extension's content script to make authenticated Facebook API calls on your behalf.
The token testing saw stored after visiting Facebook: a session credential Facebook's front-end uses to authorise requests and block CSRF.
- Location
- chrome.storage.local key 'currentFb_dtsgToken'
{ "currentFb_dtsgToken": "Ad2yvzFAoziFqCdZzkFqX3hzihJuDwO0jt_hpdmA4FBIE9dI:49:1776479026"}worker.js, service worker that intercepts and stores the token
// Registered immediately when the service worker starts.// Watches every outbound request your browser makes to Facebook's AJAX and video endpoints.chrome.webRequest.onSendHeaders.addListener( (requestDetails) => { // Read the fb_dtsg_ag CSRF token from the request's query string. const token = new URL(requestDetails.url).searchParams.get('fb_dtsg_ag'); if (token) { // Skip if we already have this exact token (de-duplication). if (this.dtsgToken === token) return; // Store the new token both in memory and in persistent extension storage. this.dtsgToken = token; chrome.storage.local.set({ currentFb_dtsgToken: token }); } }, { // Applies to all requests to these two Facebook endpoint patterns. urls: [ '*://*.facebook.com/video/video_data_async/*', '*://*.facebook.com/ajax/*' ] }, ['requestHeaders']);fbHelper.js, content script that uses the stored token to call the Facebook API
async searchVideoInfo(videoId) { // Retrieve the captured CSRF token from storage if not already in memory. if (!this.dtsgToken) { await this.getDtsgToken(); // sends message to service worker, which reads chrome.storage.local } const token = this.dtsgToken; if (!token) return; // abort if no token available // Also read the c_user cookie — Facebook's numeric user ID for the logged-in account. const userId = this.getCookie('c_user'); // Make an authenticated API call to Facebook's internal video data endpoint, // passing both the CSRF token and the user ID as query parameters. const response = await fetch( `https://www.facebook.com/video/video_data_async/` + `?video_id=${videoId}` + `&fb_dtsg_ag=${token}` + // the captured CSRF token `&__user=${userId}` + // your Facebook numeric user ID `&__a=1`, { signal: this.controller.signal } ); const text = await response.text(); const data = JSON.parse(text.replace('for (;;);', '')); // ... extracts hd_src / sd_src video download URLs from the response}- Facebook CSRF token (fb_dtsg_ag)Ad2yvzFAoziFqCdZzkFqX3hzihJuDwO0jt_hpdmA4FBIE9dI:49:1776479026
A session credential Facebook's front-end uses to authorise API requests. The extension captures it from outbound traffic and reuses it.
- Your Facebook user ID (__user / c_user)100072841930518
Your numeric Facebook account ID, read directly from the c_user cookie. Uniquely identifies your account.
- Video ID10217498302938471
The ID of the Facebook video being looked up. Determines what content the API call retrieves.
Run this in Chrome DevTools on any Facebook page with Video Downloader Pro installed. It reads chrome.storage.local and reports whether the extension has captured and stored your Facebook CSRF token.
- Chrome with Developer mode enabled
- Video Downloader Pro extension installed
- A logged-in Facebook session
// check-fb-token.js// Paste into Chrome DevTools console while on a Facebook page.// Reports whether Video Downloader Pro has stored your fb_dtsg_ag CSRF token.(async () => { // The extension stores the token under this key. const KEY = 'currentFb_dtsgToken'; // Query the extension's local storage via the background service worker. // This only works if you have access to the extension's DevTools context // (open chrome://extensions, click the service worker link for Video Downloader Pro). chrome.storage.local.get(KEY, (result) => { const token = result[KEY]; if (token) { console.log('[VIDEO-DL-PRO] fb_dtsg_ag token IS stored:', token); // Parse the token to show the embedded timestamp. const parts = token.split(':'); if (parts.length === 3) { const ts = parseInt(parts[2], 10); console.log('[VIDEO-DL-PRO] Token timestamp:', new Date(ts * 1000).toISOString()); } } else { console.log('[VIDEO-DL-PRO] No fb_dtsg_ag token found in storage yet.'); console.log(' Try loading a Facebook page and checking again.'); } });})();- 1Install Video Downloader Pro.
- 2In chrome://extensions, find it, click the service worker link.
- 3Paste this script into the console.
- 4Output shows whether your fb_dtsg_ag token was captured.
What it can do
Permissions this extension asks for, as declared in version 1.9.1. Asking for a permission is not a finding on its own - it is what the extension can do if it chooses to.
Read and change your data on every site you visit
<all_urls>
Start, monitor and manage your downloads
downloads
Store data in your browser
storage
Watch every request your browser makes
webRequest
See the address and title of every tab you have open
tabs
Run its own code inside the pages you visit
scripting